Security Implications of the “Web” Becoming the “Social Web”

People are excited about social media. Except security people, because we are paid to worry, and new technologies make us nervous. Many of us, including me, have written about the dangers of social media. Yet, it’s becoming less practical to treat this form of communications as its own entity. Social media is getting infused into all interactions.

The web as we knew it is ceasing to exist and is turning into the social web. As the result, the manner of online interactions combines many characteristics that until recently haven’t coexisted in a single communication platform. These include:

Instant one-to-one and group communications

Hard-to-control channel (HTTP and HTTPS)

Public archives of interactions

Real-time and delayed conversations

Video and audio, not just text

Support for strong and weak relationships

Accessible on the move (mobile)

The web’s metamorphosis, marked by these attributes, has information security implications, such as:

Electronic business interactions increasingly occur outside the protected boundary of the corporate network

Information is shared and archived almost instantaneously, making accidental data leaks hard, if not impossible, to contain

People communicate with many individuals whom they don’t know well, making reliance on trust impractical

Communications take non-textual multimedia form, which is hard to scan for keywords to detect data leakage

People interact with each other and data while on the move, in a hurry and multitasking, making mistakes that may have security repercussions

Clicking on links to take action or access content is common and is used as part of social engineering

These risks aren’t solely associated with social media per se. Rather, these attributes are present in routine web-based interactions. They are becoming the norm, not the exception. If we take the time to better understand the characteristics and implications social web, we might find more practical ways to safeguard personal and corporate data online.

Did you like this?

Sign up for my newsletter if you'd like to receive a note from me whenever I publish an article or embark on a project. This doesn't happen often, so I won't overwhelm you with updates.

About the Author

Lenny Zeltser is a seasoned business and technology leader with extensive information security experience. He presently oversees the financial success and expansion of infosec services and SaaS products at NCR. He also trains incident response and digital forensics professionals at SANS Institute. Lenny frequently speaks at industry events, writes articles and has co-authored books. He has earned the prestigious GIAC Security Expert designation, has an MBA from MIT Sloan and a Computer Science degree from the University of Pennsylvania.